Sci Data Extractor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:39 AM UTC
• Version: 0.1.0

Overview

The skill appears to match its stated PDF extraction purpose, but its setup and cloud-processing behavior need review before installation.

Review before installing. Prefer the built-in venv/pip or conda setup path instead of running the `curl | sh` uv installer, pin or verify any installation sources, and only process PDFs you are allowed to send to the configured LLM provider or Mathpix. Use a dedicated API key with limits, check the resolved base URL before use, and avoid batch mode for confidential or regulated documents unless the endpoint and provider policy are approved.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:59
• Finding: Unverified Remote Installer Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instructions stream a remotely hosted script directly into `sh`. The effective code is retrieved at execution time and is not pinned to a reviewed version, checked against a cryptographic hash, or verified using a signature. Although `astral.sh` is associated with the legitimate `uv` project, this pattern makes local execution dependent on mutable remote content and the security of the hosting service, DNS resolution, certificate trust chain, and delivery infrastructure. The project also documents `venv`, `conda`, and `pip` installation methods, so executing a remote installer is not necessary for the Skill's declared PDF extraction functionality. ### Attack Path 1. A user or agent follows the recommended installation instructions. 2. The shell retrieves the current contents of `https://astral.sh/uv/install.sh`. 3. An attacker compromises the hosting account, delivery infrastructure, DNS path, or another trusted component. 4. The attacker substitutes malicious shell commands in the downloaded response. 5. Because the response is piped directly to `sh`, the commands execute without inspection or integrity verification. 6. The payload runs with all permissions available to the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the user's account. The payload could read or alter accessible files, steal API credentials and environment variables, install persistence, modify development tools, or download additional payloads. If the command is run from a privileged shell, the impact extends to those elevated privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | sh` pipeline and recommend the existing built-in `venv` and `pip` installation path by default. - If `uv` is required, use a trusted platform package manager with a version constraint. - Alternatively, download a fixed-version release artifact as a separate step, verify its official cryptographic signature or published SHA-256 checksum, and only then execute it. - Pin the expected installer or artifact version so that reviewed installation instructions cannot silently begin executing different code. - Document that installation commands should run as an unprivileged user and should not use `sudo` unless strictly required. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: README_ZH.md:58
• Finding: Unverified Remote Installer Executed Directly by a Shell in Chinese Documentation<![CDATA[ ## Vulnerability Details **File Location**: `README_ZH.md`, line 58 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The documentation downloads mutable shell code from an external URL and immediately executes it. There is no fixed release version, checksum verification, signature verification, or review boundary between retrieval and execution. Installing `uv` is optional and exceeds the minimum requirements of the Skill because the same document provides installation through Python's built-in virtual environment and `pip`. Trust in the named provider does not eliminate the risk created by executing whatever content the URL serves at runtime. ### Attack Path 1. A user copies the documented command into a shell. 2. `curl` retrieves a script whose contents can change independently of this repository. 3. A compromised provider, account, DNS route, certificate authority, or distribution service returns attacker-controlled content. 4. `sh` interprets the response immediately. 5. The attacker's commands execute with the invoking user's permissions and can retrieve or install further components. ### Impact Assessment The command can provide arbitrary local code execution. Accessible documents, source code, API keys, shell configuration, and user files could be read or modified. A malicious installer could also establish persistence or tamper with tools used in later sessions. Running the command with elevated privileges would expand the impact to system-wide compromise. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Delete the direct remote-script pipeline. - Recommend `python -m venv .venv` followed by a reviewed, pinned dependency installation as the primary method. - If `uv` remains an option, use an authenticated package repository or a fixed release artifact. - Require users to verify the artifact against an official signature or checksum before execution. - Keep equivalent security guidance in all translated documentation so users do not receive weaker instructions based on language. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:36
• Finding: Skill Instructions Recommend Direct Execution of a Mutable Remote Script<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 36 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis This occurrence is especially sensitive because it appears in the Skill definition and may be followed by an AI agent while assisting with setup. It creates a direct code-execution channel whose payload can change after the Skill package has been audited. The remote response is neither pinned nor authenticated at the artifact level. The use of TLS protects transport under normal conditions but does not establish that the returned script is the exact version reviewed by the Skill author. The command is unnecessary for the declared extraction workflow because standard `pip`, `venv`, and `conda` alternatives are documented. ### Attack Path 1. The Skill is loaded and its setup instructions are followed by a user or capable agent. 2. The command retrieves the latest script from the external URL. 3. The remote content or its delivery path is compromised. 4. The unverified response is passed directly to the shell. 5. Attacker-controlled commands run locally without a separate confirmation or integrity check. ### Impact Assessment Exploitation allows arbitrary command execution with the permissions of the process following the Skill instructions. This can expose local PDFs, LLM and Mathpix credentials, project files, and other user data. It can also allow modification of shell startup files or development tooling, creating effects that survive the installation session. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove commands that pipe network responses directly into an interpreter. - Direct the agent to prefer Python's built-in virtual environment and `pip`. - If an external installer is retained, separate download, verification, inspection, and execution into distinct steps. - Pin the external tool to a specific reviewed version and verify a vendor-published signature or checksum. - Require explicit user approval before any installation command that executes downloaded code. - Ensure installation runs with minimum privileges and never requests elevation by default. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: extractor.py:45
• Finding: Sensitive PDF Content and API Credentials Can Be Sent to an Arbitrary Configured Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `extractor.py`, lines 45-46 and 208-241, with document construction at lines 275-286 **Vulnerability Type**: Unrestricted transmission of sensitive data to an environment-controlled network destination **Risk Level**: High ### Vulnerable Code ```python self.api_key = os.getenv('EXTRACTOR_API_KEY') or os.getenv('API_KEY') self.base_url = os.getenv('EXTRACTOR_BASE_URL') or os.getenv('BASE_URL') ``` ```python def __init__(self, config: Config): self.config = config self.client = OpenAI(api_key=config.api_key, base_url=config.base_url) ``` ```python completion = self.client.chat.completions.create( model=model, messages=messages, temperature=temperature, max_tokens=max_tokens, stream=False ) ``` ```python messages = [ { "role": "system", "content": "You are an expert in information extraction from scientific literature." }, { "role": "user", "content": f"""Provided Text: ''' {{\"\"\" {content} \"\"\"}} ''' {prompt}""" } ] return self.call_llm(messages, model, temperature) ``` ### Technical Analysis The program extracts PDF text into `content`, embeds the complete content in an LLM request, and sends that request through an OpenAI client whose `base_url` is controlled by environment variables. It also accepts generic `BASE_URL` and `API_KEY` fallbacks rather than requiring variables scoped specifically to this application. Network transmission is necessary for the declared cloud-LLM feature and is not concealed. However, the implementation does not validate that the destination uses HTTPS, restrict destinations to approved providers, warn about document sensitivity, redact content, or require per-document confirmation. If an attacker can influence the environment, `.env` file, wrapper process, CI configuration, or launch configuration, the attacker can redirect document contents and the API credential used by the client to an endp ...[truncated 1741 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the generic `API_KEY` and `BASE_URL` fallbacks; require application-specific configuration variables. - Reject non-HTTPS endpoints, except an explicitly enabled localhost development mode. - Maintain an allowlist of approved provider hosts or require a prominent confirmation when a custom endpoint is configured. - Before transmission, display the resolved destination and explain that extracted document contents and an authentication credential will be sent there. - Require explicit consent before uploading each document, with a separately confirmed batch mode. - Add a local-only or self-hosted model option for confidential documents. - Provide configurable redaction for personal information, credentials, and other sensitive fields. - Avoid loading `.env` files implicitly from an uncontrolled working directory; load a specific configuration path with restrictive permissions. - Use separate, least-privileged API keys with spending limits and rotation procedures. - Clearly disclose the full-document Mathpix upload when `--ocr mathpix` is selected. - Add tests that verify unsafe schemes and unapproved destinations are rejected before any document is read or transmitted. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (50)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies in project directory
cd ~/.claude/skills/sci-data-extractor

• Confidence: 98% confidence
• Finding: Piping network-fetched content directly into `sh` is a classic command-chaining pattern that eliminates any review barrier before execution. In a skill README, this is particularly dangerous because users may copy-paste setup commands verbatim, turning documentation into a one-step remote code execution path if the source is tampered with.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 安装 uv（如果还没安装）
curl -LsSf https://astral.sh/uv/install.sh | sh

# 在项目目录创建虚拟环境并安装依赖
cd ~/.claude/skills/sci-data-extractor

• Confidence: 97% confidence
• Finding: Piping remote content directly into `sh` creates an immediate command-execution path from an external source to the user's shell. In the context of a skill installation README, this is more dangerous because users are likely to copy-paste it verbatim, enabling full host compromise if the fetched script is malicious or tampered with.

Chaining Abuse

High

• Category: Tool Misuse

Content

**Method 1: Using uv (Recommended - Fastest)**
   ```bash
   # Install uv
   curl -LsSf https://astral.sh/uv/install.sh | sh

   # Create virtual environment and install dependencies
   cd /path/to/sci-data-extractor

• Confidence: 99% confidence
• Finding: The shell pipeline ending in '| sh' is a direct command-chaining execution pattern that can lead to arbitrary code execution from remote content. In skill context, this is especially risky because users may copy-paste setup instructions without scrutiny, turning documentation into an execution vector.

Credential Access

High

• Category: Privilege Escalation

Content

cp .env.example .env

   # Edit .env and add your API key
   # Get API key from: https://console.anthropic.com/
   EXTRACTOR_API_KEY=your-api-key-here
   EXTRACTOR_BASE_URL=https://api.anthropic.com
   EXTRACTOR_MODEL=claude-sonnet-4-5-20250929

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 创建 .env 文件
cp .env.example .env

# 编辑 .env，添加你的 API key
# EXTRACTOR_API_KEY=your-api-key-here

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 创建 .env 文件
cp .env.example .env

# 编辑 .env，添加你的 API key
# EXTRACTOR_API_KEY=your-api-key-here

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print("安装命令: pip install openai")
    sys.exit(1)

# 加载 .env 文件
try:
    from dotenv import load_dotenv
    load_dotenv()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print("安装命令: pip install openai")
    sys.exit(1)

# 加载 .env 文件
try:
    from dotenv import load_dotenv
    load_dotenv()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print("安装命令: pip install openai")
    sys.exit(1)

# 加载 .env 文件
try:
    from dotenv import load_dotenv
    load_dotenv()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print("安装命令: pip install openai")
    sys.exit(1)

# 加载 .env 文件
try:
    from dotenv import load_dotenv
    load_dotenv()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print("安装命令: pip install openai")
    sys.exit(1)

# 加载 .env 文件
try:
    from dotenv import load_dotenv
    load_dotenv()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print("安装命令: pip install openai")
    sys.exit(1)

# 加载 .env 文件
try:
    from dotenv import load_dotenv
    load_dotenv()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly promotes AI-powered extraction using external LLM and OCR providers, but it does not clearly warn that PDF contents, including potentially sensitive research or unpublished data, may be transmitted to third-party services. This creates a real privacy and data-governance risk because users may assume processing is local when it is not.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Install uv (if not already installed)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Create virtual environment and install dependencies in project directory
cd ~/.claude/skills/sci-data-extractor
uv venv
source .venv/bin/activate  # Linux/macOS

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

- **Anthropic Claude**: https://console.anthropic.com/
- **OpenAI**: https://platform.openai.com/api-keys
- **Mathpix OCR**: https://api.mathpix.com/

## Usage

• Confidence: 88% confidence
• Finding: The README directs users to configure Mathpix and other API-backed services, confirming that document-derived content may be transmitted off-host to third parties. In the context of a PDF extraction skill, this is security-relevant because scientific PDFs can contain confidential data, proprietary methods, or embargoed research.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly describes using external AI and OCR providers to process scientific PDFs and images, but it does not clearly warn that document contents may be transmitted to third-party services. This can lead users to upload unpublished papers, proprietary research, or sensitive data without informed consent, causing confidentiality and compliance issues.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cd ~/.claude/skills/sci-data-extractor
conda create -n sci-data-extractor python=3.11 -y
conda activate sci-data-extractor
pip install -r requirements.txt
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cd ~/.claude/skills/sci-data-extractor
conda create -n sci-data-extractor python=3.11 -y
conda activate sci-data-extractor
pip install -r requirements.txt
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents capabilities that involve network access, reading environment variables for credentials, and writing output files, but it does not declare an explicit tool/permission scope. This creates an authorization ambiguity where an agent or user may not realize the skill can transmit document contents externally or access secrets, increasing the chance of overbroad execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill advertises PDF extraction and LLM/OCR use, but it does not clearly warn that uploaded PDF content may be transmitted to third-party providers such as Anthropic, OpenAI, or Mathpix. Users may therefore process unpublished, confidential, or regulated research documents without informed consent about external data exposure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 78% confidence
• Finding: The documentation instructs users to run `npx skills add` without pinning a specific package or version. This can cause installation of whatever `skills` package or remote behavior is current at execution time, creating a supply-chain risk if the package is updated maliciously, typo-squatted, or otherwise changes unexpectedly.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This code file contains user-facing natural-language strings such as the module docstring, error messages, help text, and examples entirely in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in or documented regional justification is a policy concern.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to use Mathpix OCR with API credentials but does not warn that PDF contents will be transmitted to an external service. In a scientific-literature extractor, PDFs may contain unpublished, proprietary, or regulated data, so omission of a privacy/data-transfer notice can mislead users into exposing sensitive documents.

Static analysis

No suspicious patterns detected.